Severity: Critical | Priority: 1
N-able N-central is a remote monitoring and management platform widely used by managed service providers and IT teams to administer customers’ servers and workstations. Days after N-able released Hotfix 2 for the earlier “Able2Shell” flaws, a researcher published two new exploit chains that work against fully patched on-premise servers running 2026.4.1 HF2. The first, 4EverAble2Shell, abuses a critical Apache Axis flaw (CVE-2026-90436, CVSS 9.8) in N-central’s SOAP interface to run code on the server without logging in. It then escalates to full root control. It only works when the optional Legacy API is enabled and reachable from the internet. The second, Agent2Shell, reportedly chains more than ten unpatched flaws to run commands as SYSTEM on the Windows computers that N-central manages, if the attacker knows the target appliance’s ID.
Probes for 4EverAble2Shell began within hours of the exploit code going public. Attackers ran the chain, used curl to download a shell script from their server, and installed the XMRig cryptocurrency miner as a hidden system service. At least 21 servers have been found compromised, 19 of them running N-able’s latest security update. A miner is a relatively mild outcome. An attacker with root access to an N-central server can push commands to every managed device, making it a single point of failure for every customer the platform serves. Hosted N-central environments are not affected.
Administrators running on-premise N-central should confirm that the Legacy API is disabled. If it is genuinely needed, remove it from internet access and allow only trusted addresses until N-able releases a full fix. Keep N-central, agents and probes on the latest available versions, and follow N-able’s advisory for Agent2Shell updates. On the server, check for:
On managed Windows computers, look for encoded PowerShell commands launched as SYSTEM by the N-central agent. Any compromised server should be rebuilt from a clean installation. Rotate all N-central administrator, API and integration credentials, and review recent automation, scripts and tasks pushed to managed devices.